In recent years, the Internet rapidly has changed the way that people access information. The World Wide Web (“WWW” or “Web”) is the most popular manner in which people access and retrieve information via the Internet, and the Web enables users to access a vast number of resources from locations all around the world. In addition, businesses, enterprises, and other organizations can use software applications or “Web applications” to provide information to others via the Web and to conduct business and other transactions over the Web.
As web-based front ends continue to expand traditional web applications, an ever-growing amount of information, which is stored in corporate databases, is becoming available on the Web. While increasing the availability of this information has extended the business practices of many organizations beyond their traditional boundaries, it also increases the amount of sensitive information that is available to a growing number of employees, business partners, suppliers, on-line customers, etc.
As such, many businesses and other organizations have become weary of the vulnerability of their Web applications, databases, and sensitive information to attacks from malicious, irresponsible, or criminally-minded individuals or organizations. These organizations have heavily invested in security, such as anti-virus software and firewalls, so that they can prevent these attacks and safely use the Web. Particularly, organizations have deployed application level security systems to protect their Web applications and information.
Application level security systems have generally prevented attacks by restricting the network level access to the Web applications based on the applications' attributes. For example, these security systems may constantly monitor and gather requests received at interfaces and at various application components, correlate the application requests, and compare them with predetermined application profiles. These profiles include application attributes, such as uniform resource locators (“URLs”), cookies, user information, Internet protocol (“IP”) addresses, structured query language (“SQL”) query statements, and many others. These attributes determine the normal behavior of the protected application. If one or more application requests do not match the application profile, a security system may generate an “irregular” event and, in turn, generate an alert identifying a potential attack.
One disadvantage of these security systems is that they generate an alert identifying a potential attack based only on a single irregular event. As a result, the systems generate a relatively high number of false alarms, which reduces the accuracy and efficiency of the systems and which reduces their ability to protect the Web applications and sensitive information.